A city cloud class asks what pieces make up an Azure RBAC role assignment at a describe level. Which trio is correct?
Select an answer to reveal the explanation.
Short Explanation
RBAC assignments are three building blocks: who gets it, what role they get, and where it applies. Principal, role, scope—like name on the badge, job title, and which floor the badge opens. Miss one piece and the assignment is incomplete.
Full Explanation
An Azure RBAC role assignment at describe level is composed of three pieces: a security principal, a role definition, and a scope. The security principal is who receives permission (user, group, service principal, or managed identity). The role definition is what actions are allowed or denied (for example Reader or Contributor). The scope is where those permissions apply (management group, subscription, resource group, or individual resource). Together those three elements answer who can do what, where—the mental model AZ-900 expects for municipal cloud classrooms.
A credit card, region name, and Blob access tier describe billing and storage characteristics, not a role assignment. An Availability Zone, VPN gateway SKU, and DNS TTL mix resiliency, networking, and name-resolution settings unrelated to RBAC composition. A pricing calculator estimate, support ticket, and marketplace offer are commercial and support artifacts, not authorization assignment components.
Exam caveat: remember inheritance—permissions assigned at a higher scope flow down to child scopes unless constrained, so choosing scope carefully is part of least privilege.
Operational check: open a role assignment in the Azure portal IAM blade and identify the three fields shown (principal, role, scope); recreate the same assignment via Azure CLI or PowerShell and confirm the principal can perform only the permitted actions inside that scope.